Cached Credentials Authentication For Domain User

Hello,

Scenario:
I have a local network, I use other-computer to ssh into windows-computer using openssh-server. On windows-computer my session is a domain user it authenticates through Active directory on a domain controller.

Issue:

• When I am connected to internet (online):
  • When I ssh from other-computer to windows-computer on local network, I have noticed that ssh authentication lags a bit because it authenticates remotely to the domain controller.
  • ssh user@windows-computer-ip (works)
• When I am offline:
  I can't ssh anymore from other-computer to windows-computer. The other-computer error message is "Connection reset by windows-computer port port-number". The windows-computer error message in event viewer is "sshd: fatal: ga_init, unable to resolve user domain\user".
• The closest ticket I found related to that issue is https://github.com/PowerShell/Win32-OpenSSH/issues/1363 for users @xf6jx5fq and @shawnz

Explanation:

• To login to windows-computer there is a mechanism called cached credentials. I am able to login to windows-computer even when offline with my domain user.
• For instance on that stackoverflow post (https://stackoverflow.com/questions/48538582/principalcontext-validatecredentials-with-cached-credentials-in-c-sharp) a user explains how he can authenticate in C# with cached credentials when domain is not available because offline. I tested the code below with C# asp.net and it authenticates when offline. So it is doable to do that by code.

    PrincipalContext pcon = new PrincipalContext(ContextType.Machine, Environment.MachineName);
    var password_ok = pcon.ValidateCredentials("domain\\user", password);

• I also tried unsuccessfully to include the computer name in the ssh command because that is what Environment.MachineName provides. ex: ssh user@windows-computer-name@windows-computer-ip

Questions:

• Can I authenticate in openssh-server using cached credentials using an ssh command parameter?
• Is there a setting on openssh-server that allows using cached credentials instead of connecting to remote?
• Can the issue be solved by a Windows group policy, or Windows settings?
• If question 1, 2, 3 return false then is there a way to implement a custom authentication mechanism on openssh-server on Windows as a work-around. If not did you plan adding cached credentials authentication feature?

Any help or information on that issue is appreciated.

Thanks,

Start by reviewing the reported offline failure, the “sshd: fatal, ga_init” event, and the linked issue 1363. Compare the requested cached-credential behavior with the existing Windows OpenSSH authentication flow; done would require a clearly defined supported approach, configuration or command behavior, and validation for offline domain-user authentication.